Hamachi

From Wikipedia, the free encyclopedia

Jump to: navigation, search
 This article needs additional citations for verification. Please help improve this article by adding reliable references (ideally, using inline citations). Unsourced material may be challenged and removed. (May 2008)
This article is about the computer networking software. For the Japanese fish and sushi ingredient, see Japanese amberjack.
Hamachi
Hamachi logo
Hamachi screenshot
Screenshot of Hamachi
Developed by LogMeIn Inc.
Latest release 1.0.3.0 / 2008-08-18; 230 days ago
Operating system Microsoft Windows, Linux, Mac OS X
Type P2P, VPN
License Proprietary (Free for non-commercial use)
Website www.logmeinhamachi.com
www.hamachi.cc

Hamachi is a zero-configuration virtual private network (VPN) shareware application capable of establishing direct links between computers that are behind NAT firewalls without requiring reconfiguration (in most cases); in other words, it establishes a connection over the Internet that very closely emulates the connection that would exist if the computers were connected over a local area network. Currently available as a production version for Microsoft Windows and, as beta, for Mac OS X and Linux.


Contents

[edit] How it works

Hamachi is a centrally-managed VPN system, consisting of the server cluster managed by the vendor of the system and the client software, which is installed on end-user computers.

Client software adds a virtual network interface to a computer, and it is used for intercepting outbound as well as injecting inbound VPN traffic. Outbound traffic sent by the operating system to this interface is delivered to the client software, which encrypts and authenticates it and then sends it to the destination VPN peer over a specially initiated UDP connection. Hamachi currently handles tunneling of IP traffic including broadcasts and multicast. The Windows version also recognizes and tunnels IPX traffic.

Each client establishes and maintains a control connection to the server cluster. When the connection is established, the client goes through a login sequence, followed by the discovery process and state synchronization. The login step authenticates the client to the server and vice versa. The discovery is used to determine the topology of client's Internet connection, specifically to detect the presence of NAT and firewall devices on its route to the Internet. The synchronization step brings a client's view of its private networks in sync with other members of these networks.

When a member of a network goes online or offline, the server instructs other network peers to either establish or tear down tunnels to the former. When establishing tunnels between the peers, Hamachi uses a server-assisted NAT traversal technique, similar to UDP hole punching. Detailed information on how it works has not been made public. The vendor claims "...to successfully mediate P2P connections in roughly 95% of all cases ..." This process does not work on certain combinations of NAT devices, requiring the user to explicitly set up a port forward. Additionally 1.0 series of client software are capable of relaying traffic through vendor-maintained 'relay servers'.

In the event of unexpectedly losing a connection to the server, the client retains all its tunnels and starts actively checking their status. When the server unexpectedly loses client's connection, it informs client's peers about the fact and expects them to also start liveliness checks. This enables Hamachi tunnels to withstand transient network problems on the route between the client and the server as well as short periods of complete server unavailability.

Each Hamachi client is assigned an IP address from the 5.0.0.0/8 address block. This address is assigned when the client logs into the system for the first time, and is henceforth associated with the client's public crypto key. As long as the client retains its key, it can log into the system and use this 5.x.x.x IP address.

The 5.0.0.0/8 network is used to avoid collisions with private IP networks that might already be in use on the client side. Specifically - 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. The 5.0.0.0/8 address block is reserved by IANA and is not currently in use in the Internet routing domain, but this is not guaranteed to continue. The IANA free pool is expected to be exhausted by February 2011.[1] If this range is allocated, Hamachi users will not be able to connect to any Internet IP addresses within the range as long as the Hamachi client is running.

Additionally, using a /8 network prefix creates a single broadcast domain between all clients. This makes it possible to use LAN protocols that rely on IP broadcasts for discovery and announcement services over Hamachi networks. Hamachi is frequently used for gaming and remote administration. The vendor provides free basic service and extra features for a fee.

In February 2007, an IP-level block was imposed by Hamachi servers on parts of Vietnamese Internet space due to "the scale of the system abuse originating from blocked addresses".[2] The company is working on a less intrusive solution to the problem.[3]

[edit] Security

As with all closed-source or non-thoroughly reviewed applications, several security considerations apply:

  • The absence of source code for review
  • Its beta status (if any) and possible impact of remaining bugs on security

Additionally due to Hamachi's use as a VPN application the following considerations apply:

  • Additional risk of disclosure of sensitive data which is stored or may be logged by the mediation server- minimal where data is not forwarded
  • The security risks due to vulnerable services on remote machines otherwise not accessible behind a NAT, common to all VPNs

Hamachi claims to use strong, industry-standard algorithms to secure and authenticate the data and its security architecture is open [4]. The Hamachi implementation however is closed source and as such it is not available for review by the general public.

The existing client-server protocol documentation contains a number of errors[5][6], some of which confirmed by the vendor, pending correction[7], and others not yet confirmed.

For the product to work, a "mediation server", operated by the vendor, is required. This server stores the nickname, maintenance password, statically allocated 5.0.0.0/8 IP address and the associated authentication token of the user. For every established tunnel, it could log the real IP address of the user, time of establishment and duration as well as the other interconnected users.

As all peers sharing a tunnel have full "LAN-like" access to each others computers, security problems may arise if firewalls are not used, as with any insecure situation. The security features of the NAT router/firewall are bypassed. This is not specific to Hamachi and needs to be addressed with other VPNs as well.

In the Security Now! podcast Steve Gibson described Hamachi as a "...brand new, ready to emerge from its long development beta phase, ultra-secure, lightweight, high-performance, highly polished, multi-platform, peer-to-peer and FREE! personal virtual private networking system ..." and that he had "... fully vetted the system's security architecture ...".[8]

In the following episode, to a question raised by Randal Schwartz: "Hamachi's not open source. How can we trust it?", Gibson replied, "... it's one of the things that made me anxious and continues to make me anxious. I'm going to end up probably over on OpenVPN ...". Later he continued, "But Hamachi is - I'm convinced that Alex [Pankratov] has really designed this system exactly as he's told me he has. He's got years of experience with security, implementing IPSec tunnels, you know, classic VPN solutions. I couldn't feel any better about this than I do, short of doing a complete source audit ... which is just not practical. So it's certainly the case though that, well, I mean, you know, we're trusting Bill when we use Windows.", and, "... I'm sure Alex has told me the truth, but I have no proof of it."[9]

[edit] Compatibility

The current builds of Hamachi are available for the following operating systems:

  • Microsoft Windows (Windows 2000, XP, Server 2003 and Vista only. Due to the way that Hamachi creates the virtual network adapter, Windows 95/98/ME/NT cannot be supported)
  • Linux 2.4 or newer (console-only) (x86 and nokia770/arm binary only) (unofficial GUI front-end: hamachi-gui)
  • FreeBSD
  • Mac OS X (console-only) (universal binary - runs on Intel as well as PPC Macs) (unofficial GUI front-end: HamachiX) Non official Shimo also support Hamachi.

Prior to versions 1.0.2.0 and 1.0.2.1 for the Windows release [10], many Windows Vista users had experienced compatibility and connection issues while using Hamachi. As of March 30, 2007, the software now includes Vista tweaks, which answer these OS-related problems, among other specific solutions. [11]

[edit] Server Load

Since Hamachi relies on a central server to process log in requests, at high traffic times users may not be able to access their Hamachi accounts.

[edit] See also

Virtual Private Networks

Network address translation

[edit] References

  1. ^ Geoff Huston's analysis Retrieved 2008-08-14.
  2. ^ IP-level block Hamachi.cc. Hamachi Team. February 14, 2007. Retrieved 2007-04-24.
  3. ^ Re: Can i connect... Hamachi.cc. Hamachi Team. Mar 11, 2007. Retrieved 2007-04-24.
  4. ^ LogMeIn Hamachi - Security Architecture
  5. ^ Hamachi protocol documentation errors
  6. ^ More Hamachi protocol documentation concerns
  7. ^ Acknoledgement of documentation errors
  8. ^ "Hamachi" Rocks! transcript. GRC.com, "Security Now!" ep. #18. Gibson and Laporte, December 15, 2005. Retrieved 2007-04-24.
  9. ^ VPNs Three..., transcript GRC.com, "Security Now!" ep. #19. Gibson and Laporte, December 22, 2005. Retrieved 2007-04-24.
  10. ^ Hamachi for Windows, change log
  11. ^ Hamachi Community Forums - 1.0.2.1 is released

[edit] External links


v • d • e
Virtual Private Networking
Retrieved from "http://en.wikipedia.org/wiki/Hamachi"
Personal tools